Skills (vercel-labs)
github.com/vercel-labs/skills- Category
- Developer Tools
- Rank
- No. 714Tools index
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Coding
- Interfaces
- CLI
- GitHub
- 36.8k stars
- Latest release
- v1.7.4
- Date
About
Skills is a CLI tool for installing and using reusable "agent skills" across more than 75 coding agents, including Claude Code, Cursor, Codex, and OpenCode. It can install a skill into a project or generate a skill's prompt on demand and pipe it directly into a supported agent without installation.
What it does
A Node command-line package manager for the instruction folders that AI coding tools read. You point it at a GitHub repo, GitLab, Azure Repos, any git remote, a local folder or a download link; it finds every skill inside, asks which tools should receive them, and keeps one master copy that each tool links to. It also lists, searches, updates, removes and scaffolds skills, and tracks where each one came from so later updates know what to fetch.
Why it's ranked here
It solves a real fan-out problem with unusual care: one folder, linked into dozens of tool directories, each with its own home path and environment override. MIT licensed by Vercel, it ships only two runtime dependencies, and the source shows deliberate defences: skill names are rewritten to block directory traversal, untrusted text is stripped of terminal escape codes before printing, and remote archives are capped at 10 MiB download and 1000 files. The weak spots are default-on telemetry and a few commands still labelled experimental.
What's good
Symlinking to a single master copy means an update lands everywhere at once, and when a link cannot be made it falls back to copying, using directory junctions on Windows. Private repositories reuse whatever git credentials, SSH keys or GitHub CLI login you already have, and the README states it never pulls the stored GitHub CLI token into its own process. Before installing, it can show third-party risk ratings for each skill, and that lookup gives up after three seconds rather than blocking. Add and list both offer machine-readable JSON output for scripts.
Tradeoffs
Every install, removal, update and search sends an event to a Vercel endpoint unless you set an opt-out environment variable, and the event carries the source, skill names and target tools. The global lock file is thrown away and rebuilt empty whenever its format version is older than the current one, so upgrades can forget provenance. Restoring from the lock file and syncing from installed npm packages are both still marked experimental. It requires Node 22.20 or newer, which rules out older CI images.
How to use it well
Best for a team that uses more than one AI coding tool and wants the same instruction sets in all of them, committed alongside the code. Run it non-interactively in CI with explicit skill and tool names plus the skip-prompts flag. Set the telemetry opt-out variable in shared or sensitive environments. Prefer symlink mode unless your filesystem refuses links. It manages files only: it does not judge whether a skill's instructions are any good, so read them before trusting a third-party source.
Technical notes+
Entry is src/cli.ts, which dispatches to add, use, find, list, remove, update, init and the experimental_install/experimental_sync commands. src/installer.ts writes the canonical copy under .agents/skills, runs sanitizeName and isPathSafe on every destination, refuses targets that overlap the source path, and creates relative symlinks (junctions on win32) after resolving parent symlinks with realpath. src/agents.ts holds the per-agent table of skillsDir, globalSkillsDir and detectInstalled, honouring CODEX_HOME, CLAUDE_CONFIG_DIR and similar overrides. src/skill-lock.ts stores a version 3 lock at XDG_STATE_HOME or ~/.agents/.skill-lock.json. src/telemetry.ts posts events to a Vercel endpoint unless DISABLE_TELEMETRY or DO_NOT_TRACK is set. src/sanitize.ts strips CSI, OSC, DCS and C1 sequences. src/source-parser.ts rejects '..' subpaths and parses Azure _git URLs.
Observed
- License
- MIT
- Language
- TypeScript, requires Node 22.20.0 or newer
- Packaging
- npm package exposing two command names, run via npx
- Runtime dependencies
- Two: tar and yaml
- Interface
- CLI with interactive prompts and JSON output for add and list
- Install sources
- GitHub, GitLab, Azure Repos, generic git, local paths, direct archive URLs
- Install mode
- Symlink to one canonical copy by default, copy as fallback or on request
- Telemetry
- On by default, disabled by DISABLE_TELEMETRY or DO_NOT_TRACK
- Remote archive caps
- 10 MiB fetched, 25 MiB extracted, 1000 archive files, overridable
Read from README.md, package.json, LICENSE, src/cli.ts, src/add.ts, src/installer.ts, src/agents.ts, src/skill-lock.ts, src/sanitize.ts, src/telemetry.ts, src/source-parser.ts.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.